Systems-Theoretic Process Analysis: AUTOMOBILE FEATURES FOR LANE MANAGEMENT

Transcription

1 Systems-Theoretic Process Analysis: AUTOMOBILE FEATURES FOR LANE MANAGEMENT Diogo Castilho, Megan France & Dajiang Suo Image source: 1 LADAR image of London streets (The New York Times, 11/11/15) 1

2 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 2

3 WHY STUDY AUTOMATED DRIVING? TODAY More features than ever on the market Predicted growth in the near future! Image source: 2 Safety, efficiency, and opportunity for mobility 3

4 AUTOMATION LEVELS 4 Image sources: 3. 4

5 AUTOMATION LEVELS 5 Image sources: 3. 4

6 AUTOMATION LEVELS 1. Driver Assistance 2. Partial Automation 3.Conditional Automation 5. Full Automation Image sources: 5-8 6

7 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 7

8 OUR PURPOSE MIT Human Systems Engineering Examine the impact of automated lane management on safety using STPA and human factors principles Use Tesla Model S Autopilot Version 7.0 as a case study for human factors STPA 8

9 TEST CASE SELECTION Why use Tesla system for our analysis? Media attention, information availability Automation increase via software update NOT sponsored by Tesla or any other manufacturer Generalizable method & results Neither criticism nor advertisement for Tesla ALL automated systems have some of these issues 9

10 PARTIAL AUTOMATION the driving mode-specific execution by one or more driver assistance systems of both steering and acceleration/deceleration with the expectation that the human driver perform all remaining aspects of the dynamic driving task 4 10

11 PROJECT STRUCTURE MODEL S DESIGN INFORMATION MODEL S TEST DRIVE HUMAN FACTORS PRINCIPLES SYSTEMS THEORETIC PROCESS ANALYSIS (STPA) HUMAN FACTORS FINDINGS 11

12 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 12

13 TESLA AUTOPILOT VERSION 7.0 Partial Automation Based on Driver Assistance Systems 9,10 Lane Assist Collision Avoidance Speed Assist Traffic-Aware Cruise Control Autosteer Auto Lane Change Autopilot Tech Package 13

14 BASIC AUTOPILOT FEATURES Lane Departure and Side Collision Warning Systems Alerts even when autopilot features are not active Forward Collision Warning Alerts the driver about vehicles close ahead Engage the Automatic Emergency Braking system to reduce the severity of an impact (Mental Model) Speed Assist Compares road signs and GPS data - speed limit 14

15 LANE MANAGEMENT FEATURES Auto Lane Change Relies on Traffic-Aware Cruise Control and Autosteer Driver uses the turn signal Vehicle checks for other vehicles in adjacent lane Overtake Acceleration: Activates when the driver triggers auto lane change Without driver pressing accelerator, the vehicle accelerates to match the speed of traffic 15

16 LANE MANAGEMENT FEATURES Traffic-Aware Cruise Control Selected time to impact Selected speed if no car ahead Autosteer Middle of the lane Follows the car ahead if lane markings are not detected 16

17 AUTOPILOT SENSOR LIMITATIONS 17 Image source: 10

18 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 18

19 TEST DRIVE WITH TESLA MODEL S Video source: Diogo Castilho 19

20 TEST DRIVE WITH TESLA MODEL S Interface evaluation Sources of Mode Confusion Handling qualities (Gain and Time Delay) Image source: Diogo Castilho Feature Speed Assist Traffic-Aware Cruise Control Autosteer Auto Lane Change Test Drive Task Maintain selected speed Maintain distance to a car ahead Lane Keeping Lane Changing 20

21 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 21

22 SYSTEM ACCIDENTS AND HAZARDS System Level Accidents A-1 Loss of life and injury A-2 Economic loss System Level Hazards H-1 Vehicle does not maintain safe distance from nearby vehicles H-2 Vehicle does not maintain safe distance from terrain and other obstacles H-3 Vehicle occupants exposed to harmful effects and/or health hazards 22

23 SAFETY CONTROL STRUCTURE Driver Steering Gas Pedal Brake Enable autopilot Disable autopilot Change lane Warning signals Lane Management System Dashboard indicators Audio chime Display Visual Clues Physical feedback Disengage Change lane Keep lane Accelerate Reduce Speed Physical Vehicle 23

24 Controller UNSAFE CONTROL ACTIONS Control Action Not providing causes hazards Driver Steering - Driver Auto- Pilot Auto- Pilot Steering Lane changing Reduce Speed UCA-8: Driver does not provide steering to avoid obstacles when autopilot does not react UCA-13: Auto-pilot Not providing lane changing automatically causes hazards UCA-17: Auto-pilot does not provide reducing speed can cause hazards if range and range rate of current vehicle is above the limit Providing causes hazards UCA-7: Driver provides steering can cause hazards if autopilot is changing the lane to the opposite direction Incorrect Timing / Order Stopped too soon / Applied too long

25 SCENARIO A UCA: Driver provides steering commands when autopilot is keeping the lane. Scenario: Driver provides steering commands when autopilot is keeping the lane because the driver realizes that the autopilot has followed the right lane marking onto an exit ramp. This causes a hazard because autopilot speed assist has reduced the speed to match exit ramp speed limit, and is now travelling too slowly for highway travel, and a vehicle is approaching from the rear. 25

26 SCENARIO A 26

27 SCENARIO B UCA: Driver does not steer around debris when autopilot is not programmed to handle such situations. Scenario: Driver does not brake when the autopilot doesn t react to a collision risk ahead. The driver incorrectly believed that autopilot would break or swerve around the debris. Autosteer had been keeping the lane when the car in front swerved, leaving inadequate time for collision avoidance to take effect. 27

28 SCENARIO B 28

29 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 29

30 CHANGES IN AUTOPILOT 7.1 Reality House connection Summon Private Uber Restriction in residential roads Why stepping back? Are we afraid? 30

31 They are coming! 31

32 WHEN DO WE HAVE ENOUGH SCENARIOS? 32

33 DISCUSSION: HUMAN FACTORS Physical Interface Level Multi-function lever ambiguity 10 Can enable autosteer with double pull on lever Single pull on lever engages speed assist Push lever to pause and resume speed assist, keeping target speed Difficult to differentiate levers Autopilot, Turn signal, and wheel position are all controlled by adjacent levers 10 Need to color, shape, size, or location code 33

34 DISCUSSION: HUMAN FACTORS System design / architecture level Partial automation limitations 12, 13 Inability to steer around obstacles and navigate Conditional limitations Overtrust issues Driver may misunderstand the automation purpose or process Image source: 3 34

35 DISCUSSION: HUMAN FACTORS Workload, Yerkes-Dodson Law 12,16 Poor performance in low workload conditions Partial automation still requires driver action Changing Level of Automation Triggered by event/ task complexity 35

36 DISCUSSION: HUMAN FACTORS Workload, Yerkes-Dodson Law 12,16 Poor performance in low workload conditions Partial automation still requires driver action Changing Level of Automation Triggered by event/ task complexity 36

37 DISCUSSION: HUMAN FACTORS What do we do? Some considerations Examine appropriateness of the design Consider reducing the need for human response, OR Consider increasing human responsibility to maintain awareness Improve driver mental models How is the feature marketed? Is there brief, clear documentation available? Or is the design intuitive in the first place? Image source: 14 37

38 MOTIVATION AND BACKGROUND PURPOSE AND PROJECT STRUCTURE SYSTEM OVERVIEW TEST DRIVE STPA RESULTS DISCUSSION CONCLUSIONS 38

39 CONCLUSIONS Using STPA helped us identify hazards, unsafe actions, and possible causal scenarios STPA scenarios clearly reveal human factors issues with automated lane management features with broad applicability We recommend using STPA with a focus on human factors for similar systems 39

40 ACKNOWLEDGEMENTS Dr. Nancy Leveson & Dr. John Thomas Dr. Leia Stirling Scholarship from CNPQ And Dajiang Suo! 40

41 REFERENCES 1. Manaugh, G. (2015, November 11). The Dream Life of Driverless Cars. Retrieved December 7, Fully self-driving cars expected by 2030, says forecast - UPDATE. (2014, January 3). Retrieved December 7, Stirling, L. (2015, November 3). Automation [PowerPoint slides]. Retrieved from 4. SAE J 3016: Taxonomy and definitions for terms related to on-road motor vehicle automated driving systems. (2014). SAE International. 5. Audi adaptive cruise control. (2015). Retrieved December 8, 2015, from 6. De Looper, C. (2015, October 15). Tesla Pushes 'Autopilot' Update: Model S Can Now Drive Itself. Retrieved December 7, 2015, from 7. Enhanced Active Park Assist. (2014, August 26). Retrieved December 7, 2015, from 8. Kelly, S. (2014, May 28). 8 Big Questions About Google's Self-Driving Car. Retrieved December 7, 2015, from 9. Model S. (n.d.). Retrieved December 7, 2015, from Model S Owner's Manual. (2015). Tesla Motors. 11. Leveson, N. (2012). Engineering a safer world systems thinking applied to safety. Cambridge, Mass.: The MIT Press. 41

42 REFERENCES 12. Proctor, R., & Van Zandt, T. (2008). Human factors in simple and complex systems (Second ed.). Boca Raton, Florida: CRC Press, Taylor & Francis Group. 13. Sheridan, T. (2012). Chapter 38: Supervisory Control. In G. Salvendy (Ed.), Handbook of human factors and ergonomics (4th ed.). Hoboken: John Wiley & Sons. 14. PLC Automation. (n.d.). Retrieved December 7, 2015, from Yerkes Dodson Law. (n.d.). Retrieved December 7, 2015, from Yerkes, R. M. & Dodson, J. D. (1908). The relation of strength of stimulus to rapidity of habit formation Journal of Comparative Neurology and Psychology, 18, Endsley, M. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors 37(1),